CVE-2026-13898: Chrome Cast Receiver Use-After-Free RCE

Technical summary

CVE-2026-13898 is a use-after-free vulnerability (CWE-416) in the Cast Receiver module of Chromium/Chrome. The defect allows remote code execution within the Chrome sandbox when a user visits a crafted HTML page. The vulnerability requires user interaction and network access but no authentication. The Chromium security team assessed this as Medium severity despite the HIGH CVSS 3.1 score of 8.8 (vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), likely because the sandbox constrains the scope of compromise. Remediation is available in Chrome 150.0.7871.47 and later versions.

Business impact

Organizations relying on Chrome for business operations face risk if users visit untrusted websites. The sandbox mitigates full system compromise, but successful exploitation could exfiltrate session cookies, local site data, and sensitive information within the browser context. For enterprises without strong web access controls or user awareness training, this poses a medium-to-high operational risk. Delayed patching extends the window during which social engineering attacks leveraging this vulnerability could succeed.

Affected systems

Google Chrome versions prior to 150.0.7871.47 are affected. All platforms—Windows, macOS, and Linux—are vulnerable. The Cast Receiver component is enabled by default in Chrome and is used for Chromecast streaming and related features. Any user on an unpatched Chrome installation who visits a malicious page is at risk.

Exploitability

This vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating no confirmed active exploitation in the wild at the time of publication. However, the attack is practical: it requires only that a user visit a malicious website (via link, email, or search result), making it suitable for watering-hole or phishing campaigns. The low complexity and low attack prerequisites mean exploitation difficulty is minimal once a weaponized page is prepared. The user-interaction requirement is a modest friction point but insufficient to consider this low-risk.

Remediation

Update Google Chrome to version 150.0.7871.47 or later immediately. Chrome's auto-update mechanism typically deploys patches within 24–48 hours of release on Windows and macOS; Linux distribution timelines vary. For organizations managing Chrome via Group Policy or MDM, push the update to all endpoints. Verify successful installation by checking chrome://version. No workarounds exist; patching is the only mitigation. Consider pairing the patch rollout with user awareness messaging about visiting untrusted sites.

Patch guidance

1. For consumer and small-business users: Enable automatic updates in Chrome (Settings > About > Google Chrome auto-updates). Most users will receive version 150.0.7871.47 or higher automatically within days of release. 2. For enterprise deployments: Use Group Policy (Windows) or similar management tools to enforce Chrome version ≥150.0.7871.47 across your estate. Test the patch in a non-production environment first to rule out compatibility issues with internal web applications. 3. Verify patch status: Direct users to chrome://version to confirm they are running 150.0.7871.47 or later. 4. Timeline: Prioritize this patch as high-priority; apply within 7–14 days to minimize exposure.

Detection guidance

Real-time detection of exploitation attempts is difficult without network sandboxing or browser telemetry. However, security teams can: 1. Monitor Chrome update compliance using MDM or endpoint management tools; flag unpatched instances. 2. Review user browsing logs for visits to known malicious domains (if logging is enabled). 3. Watch for unusual Cast Receiver activity or crashes correlated with visits to untrusted sites. 4. Deploy endpoint detection and response (EDR) tools to alert on suspicious child processes spawned from Chrome that may indicate sandbox escape or privilege escalation. 5. Educate users to report unexpected browser crashes or performance degradation. Post-exploitation forensics should focus on examining browser cache, cookies, and download history for signs of data exfiltration.

Why prioritize this

Although this vulnerability does not yet appear on the KEV catalog, its combination of network attack surface, low complexity, and HIGH CVSS score (8.8) makes it a priority. The sandbox containment prevents full system compromise, mitigating some risk, but the potential for data theft from the browser context is significant. The required user interaction is a limiting factor but not a reason to deprioritize; phishing and social engineering remain effective. Organizations should treat this as a 7–14 day remediation target to align with typical patch-cycle SLAs for high-severity browser vulnerabilities.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects the high impact on confidentiality, integrity, and availability of the affected process, combined with low attack complexity and no privilege requirement. The user-interaction requirement (UI:R) slightly lowers the score but does not downgrade it to MEDIUM, given the practical ease of social engineering. The sandboxed scope (S:U) prevents lateral movement to the host OS, preventing a CRITICAL rating. For risk quantification, treat this as a high-priority issue but acknowledge that containment within the sandbox reduces organizational blast radius compared to an unsandboxed RCE.

Frequently asked questions